{"record":{"id":"2e252fa9c043c2f1","repo":"getredash/redash","slug":"you-must-set-the-redash-cookie-secret-environment","errorCode":null,"errorMessage":"You must set the REDASH_COOKIE_SECRET environment variable. Visit http://redash.io/help/open-source/admin-guide/secrets for more information.","messagePattern":"You must set the REDASH_COOKIE_SECRET environment variable\\. Visit http://redash\\.io/help/open-source/admin-guide/secrets for more information\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"critical","filePath":"redash/settings/__init__.py","lineNumber":62,"sourceCode":"QUERY_RESULTS_CLEANUP_ENABLED = parse_boolean(os.environ.get(\"REDASH_QUERY_RESULTS_CLEANUP_ENABLED\", \"true\"))\nQUERY_RESULTS_CLEANUP_COUNT = int(os.environ.get(\"REDASH_QUERY_RESULTS_CLEANUP_COUNT\", \"100\"))\nQUERY_RESULTS_CLEANUP_MAX_AGE = int(os.environ.get(\"REDASH_QUERY_RESULTS_CLEANUP_MAX_AGE\", \"7\"))\n\nQUERY_RESULTS_EXPIRED_TTL_ENABLED = parse_boolean(os.environ.get(\"REDASH_QUERY_RESULTS_EXPIRED_TTL_ENABLED\", \"false\"))\n# default set query results expired ttl 86400 seconds\nQUERY_RESULTS_EXPIRED_TTL = int(os.environ.get(\"REDASH_QUERY_RESULTS_EXPIRED_TTL\", \"86400\"))\n\nSCHEMAS_REFRESH_SCHEDULE = int(os.environ.get(\"REDASH_SCHEMAS_REFRESH_SCHEDULE\", 30))\nSCHEMAS_REFRESH_TIMEOUT = int(os.environ.get(\"REDASH_SCHEMAS_REFRESH_TIMEOUT\", 300))\n\nAUTH_TYPE = os.environ.get(\"REDASH_AUTH_TYPE\", \"api_key\")\nINVITATION_TOKEN_MAX_AGE = int(os.environ.get(\"REDASH_INVITATION_TOKEN_MAX_AGE\", 60 * 60 * 24 * 7))\n\n# The secret key to use in the Flask app for various cryptographic features\nSECRET_KEY = os.environ.get(\"REDASH_COOKIE_SECRET\")\n\nif SECRET_KEY is None:\n    raise Exception(\n        \"You must set the REDASH_COOKIE_SECRET environment variable. Visit http://redash.io/help/open-source/admin-guide/secrets for more information.\"\n    )\n\n# The secret key to use when encrypting data source options\nDATASOURCE_SECRET_KEY = os.environ.get(\"REDASH_SECRET_KEY\", SECRET_KEY)\n\n# Whether and how to redirect non-HTTP requests to HTTPS. Disabled by default.\nENFORCE_HTTPS = parse_boolean(os.environ.get(\"REDASH_ENFORCE_HTTPS\", \"false\"))\nENFORCE_HTTPS_PERMANENT = parse_boolean(os.environ.get(\"REDASH_ENFORCE_HTTPS_PERMANENT\", \"false\"))\n# Whether file downloads are enforced or not.\nENFORCE_FILE_SAVE = parse_boolean(os.environ.get(\"REDASH_ENFORCE_FILE_SAVE\", \"true\"))\n\n# Whether api calls using the json query runner will block private addresses\nENFORCE_PRIVATE_ADDRESS_BLOCK = parse_boolean(os.environ.get(\"REDASH_ENFORCE_PRIVATE_IP_BLOCK\", \"true\"))\n\n# Whether to use secure cookies by default.\nCOOKIES_SECURE = parse_boolean(os.environ.get(\"REDASH_COOKIES_SECURE\", str(ENFORCE_HTTPS)))\n# Whether the session cookie is set to secure.","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/getredash/redash/blob/ca79fe988d81cdac9675b412f3dfcab107bc1fbc/redash/settings/__init__.py#L44-L80","documentation":"Raised at import time of redash.settings (redash/settings/__init__.py:62) when the REDASH_COOKIE_SECRET environment variable is not set. This secret signs Flask session cookies; because it is security-critical, Redash refuses to start without it and points to the official secrets documentation.","triggerScenarios":"Starting the Redash server or worker (or importing redash.settings, as tests do) in any environment where REDASH_COOKIE_SECRET is unset — fresh installs, new containers/services, CI, or after a dotenv/overrides file stopped being loaded.","commonSituations":"New docker-compose deployment where the env var was never added to .env; systemd unit or Kubernetes manifest missing the variable; running management commands in a shell without the project's env activated.","solutions":["Generate a strong value: `openssl rand -base64 32` and export REDASH_COOKIE_SECRET=<value> in the server's environment (.env for docker-compose, systemd Environment=, k8s Secret)","Keep the same value across restarts and all server/worker processes, otherwise sessions/CSRF tokens invalidate","If REDASH_SECRET_KEY (datasource encryption key) is also unset, set it too to avoid a fallback coupling to the cookie secret","For local dev/tests, put the variable in a sourced .env or conftest setup"],"exampleFix":"# before\n$ python manage.py db upgrade\nException: You must set the REDASH_COOKIE_SECRET ...\n# after\n$ export REDASH_COOKIE_SECRET=$(openssl rand -base64 32)\n$ python manage.py db upgrade","handlingStrategy":"validation","validationCode":"import os\nassert os.environ.get('REDASH_COOKIE_SECRET'), 'REDASH_COOKIE_SECRET must be set before boot'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate once (openssl rand -base64 32) and store in a secrets manager; inject into all server/worker processes","Add a startup preflight check in docker-compose/systemd/k8s manifests","Never reuse the cookie secret across environments; back it up — rotating it logs everyone out"],"tags":["redash","environment-variable","configuration","startup"],"backgroundTag":"missing-env-var","analyzedSha":"ca79fe988d81cdac9675b412f3dfcab107bc1fbc","analyzedAt":"2026-08-28T18:32:34.637Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}